CODEWITHSUNDEEP
windowsrecursionvbscriptregistry
JayJonahJameson
JayJonahJameson

Reputation: 41

Recursive search of HKU registry hive for a DWORD value

I need help with a VBScript that will recursively search the Windows HKU registry hive for a DWORD value. It would be helpful if the script could ignore the system accounts only looking in the S-1-5-21* keys. I MUST accomplish this using the HKU hive and not the HKCU hive because the program I plan to use to run the script runs in the context of system. No way around that.

Thank you.

Const HKCU = &H80000001  
Const HKLM = &H80000002  
Const HKU =  &H80000003  

strComputer = "."

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _
   strComputer & "\root\default:StdRegProv")

'Read the HKEY_CURRENT_USER hive, registry path, and valuename to retrieve settings
strKeyPath = "Software\Policies\Microsoft\Windows\System\Power"
strValueName = "PromptPasswordOnResume"
oReg.GetDWORDValue HKCU,strKeyPath,strValueName,dwValue

'Return a failure exit code if entry does not exist
If IsNull(dwValue) Then
   Wscript.Echo "The value is either Null or could not be found in the registry."
   WScript.Quit 1

'Return a failure exit code if value does not equal STIG setting    
ElseIf dwValue <> 1 Then
   Wscript.Echo "This is a finding. ", strValueName,"=", dwValue
   WScript.Quit 1

'Return a passing exit code if value matches STIG setting   
ElseIf dwValue = 1 Then
   Wscript.Echo "This is not a finding. "
   WScript.Quit 0

End If

All this is what I ultimately came up with to resolve my issue. 

Const HKEY_CURRENT_USER = &H80000001  
Const HKEY_LOCAL_MACHINE = &H80000002  
Const HKEY_USERS = &H80000003  

'Set the local computer as the target

strComputer = "."

'set the objRegistry Object 
Set objRegistry = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\default:StdRegProv")

'Enumerate All subkeys in HKEY_USERS
objRegistry.EnumKey HKEY_USERS, "", arrSubkeys

'Define variables
strKeyPath = "\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments"  
strValueName = "HideZoneInfoOnProperties"  
strSID = "S-1-5-21-\d*-\d*-\d*-\d{4,5}\\"  
strValue = 1  

f = True

For Each i in arrSubKeys
    Set objRegExp = New RegExp
        objRegExp.IgnoreCase = True
        objRegExp.Global = True
        objRegExp.Pattern = strSID

    Set colMatches = objRegExp.Execute(i + strKeyPath)  
        For Each objMatch In colMatches
        objRegistry.GetDWORDValue HKEY_USERS,i + strKeyPath,strValueName,dwValue

            If IsNull(dwValue) Then
                WScript.Echo "This is a finding, the key " & i + strKeyPath & "\" & strValueName & " does not exist."
                f = False
            ElseIf dwValue <> strValue Then
                WScript.Echo "This is a finding, the " & i + strKeyPath & "\" & strValueName & ": " & dwValue & " does not equal REG_DWORD = " & strValue & "."
                f = False
            ElseIf dwValue = strValue Then
                WScript.Echo "This is not a finding " & i + strKeyPath & "\" & strValueName & " = " & dwValue
            End If
        Next


Next

    If f Then
        WScript.Quit 0
    Else
        WScript.Quit 1
    End If

Upvotes: 4

Views: 4930

Answers (2)

Ansgar Wiechers
Ansgar Wiechers

Reputation: 200293

You don't need recursion here. Simply iterate over the subkeys of HKEY_USERS and (try to) read the value. The return code of GetDWORDValue() will indicate whether or not the value could be read.

Const HKEY_USERS = &h80000003

subkey = "Software\Policies\Microsoft\Windows\System\Power"
name   = "PromptPasswordOnResume"

computer = "."

Set reg = GetObject("winmgmts://" & computer & "/root/default:StdRegProv")

reg.EnumKey HKEY_USERS, "", sidList
For Each sid In sidList
  key = sid & "\" & subkey
  rc = reg.GetDWORDValue(HKEY_USERS, key, name, val)
  If rc = 0 Then
    If val = 1 Then
      WScript.Echo "OK"
      WScript.Quit 0
    Else
      WScript.Echo "Not OK"
      WScript.Quit 1
    End If
  End If
Next

Upvotes: 3

Shivam Gupta
Shivam Gupta

Reputation: 427

I am not sure if i got you right. If it is that you want to search in the HKU not in the HKCU, then the point is that an account in HKU is mapped to HKCU. Like in your case S-1-5-21* will be mapped to HKCU. You can check it by modifying an entry in HKCU and that will be reflected in HKU(S-1-5-21*) and vice-a-versa.

Upvotes: 0

Related Questions